Hello All
Can someone please help me with the following problem
On the surface of it this would not appear to be too difficult, however, it is proving more difficult than I first thought
If you looked a various documentation like the following
https://www.alexandreviot.net/2014/09/30/sql-server-could-not-register-the-service-principal-name-spn/
(and I have seen several other documents which say the same thing)
if you want the add an SPN (service principal name) record to AD you need the following 'two' rights
'Validate write to service principal name" and "write service principal name"
now if you look at a computer object using Active Directory Users and Computers (dsa.msc) then click on the 'Security' tab you can see the first right Validate write to service principal nameon the initial list of permissions. In order to see the other right "write service principal name"you need to click on 'Advanced' then select a user from the list and select 'Edit' then select the 'Properties' (now this is important thing which I will come to later) Tab
So basically when you look at 'Advanced rights' there is a tab for 'Object' and another for 'Properties' e.g. rights to the 'object' and rights to the 'properties' of the object.
Using PowerShell I can retrieve a list of users/computers/groups who have rights to the "Validate write to service principal name"(e.g. users who have Allow Read or Allow Write etc.. to this right for the 'object')
However, I cannot obtain a list of users etc who have the "write service principal name" right.
I think the problem is PowerShell is only returning rights to 'objects' and not rights to 'properties' of those objects
for example here is a simple piece of code to get the "Validate write to service principal name"rights as these <g class="gr_ gr_4968 gr-alert gr_spell gr_disable_anim_appear ContextualSpelling" data-gr-id="4968" id="4968">writes</g> are represented by GUIDs and 'f3a64788-5306-11d1-a9c5-0000f80367c1'<g class="gr_ gr_4969 gr-alert gr_spell gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="4969" id="4969">equats</g> to Validate write to service principal name
https://msdn.microsoft.com/en-us/library/ms684417(v=vs.85).aspx
$ComputerName="Server01"
$ADObject=Get-ADObject-Identity$ComputerName.distinguishedName-Properties*
$ADObject.nTSecurityDescriptor.Access|where {$_.ObjectType-eq'f3a64788-5306-11d1-a9c5-0000f80367c1'}
I have another script that translates these GUIDs via the Schema and shows them all. However again I cannot see to get the <g class="gr_ gr_4970 gr-alert gr_spell gr_run_anim ContextualSpelling" data-gr-id="4970" id="4970">write</g>
service principal name via a script and match this up to what I see in the GUI (dsa.msc)
I need to do a scan of my AD and check who has 'both' the above rights and at the moment I can only get one right e.g. "Validate write to service principal name"
Any help most welcome
Thanks
__AAnotherUser
AAnotherUser__